SB2026032553 - Missing release of memory after effective lifetime in Linux kernel intel ice driver

Description

This security bulletin contains information about 1 vulnerability.

1) Missing release of memory after effective lifetime (CVE-ID: CVE-2026-23389)

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper memory management in the ice_set_ringparam() function when processing ring parameter configuration. A local user can trigger improper memory deallocation to cause a denial of service.

Exploitation requires access to the network interface control functionality, which is typically available to local users with network configuration privileges.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/44ba32a892b72de3faa04b8cfb1f2f1418fdd580
• https://git.kernel.org/stable/c/fe868b499d16f55bbeea89992edb98043c9de416